I am working on some obfuscated code. To my understanding, here is how the obfuscation works:

Take the subroutine you want to obfuscate, like;

LDR             R2, [R0,#8]
MOV             R0, #0
CMP             R2, R1
MOVEQ           R0, #1
BX              LR

Take a few hundred to thousand of these and chain them:

LDR             PC, =0xabcd

Occasionally in the chain, add the next instruction of the function before the next LDR instruction.

LDR             R2, [R0,#8]
LDR             PC, =0x1234

... another 300 jumps...

MOV             R0, #0
LDR             PC, =0x5678


So when stepping through this program in a debugger, you have to follow a few hundred of these LDR, PC =0xABCD "chained" together before you reach the next instruction of actual code.

What is this called, and how is it generated? Is there an easy way to skip all the jumping around when debugging in IDA (ie. step to the next non-LDR PC, = instruction)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.